GET parameters validation - yii2

Question

Every Yii2 guide/tutorial that I have come across ignores the validation of GET parameters. I'm wondering why.
To give an example, take a look at this code:
public function actionView($id)
{
/* #var $model ActiveRecord */
$model = Model::findOne($id);
if ($model) {
return $this->render('view', ['model' => $model]);
} else {
throw new \yii\web\NotFoundHttpException();
}
}
I understand that if you pass invalid argument to findOne() method, it will just return null and nothing bad happens. But is this really the best practice? I have always tried to be very careful with user input and the way I see it, user input should be validated immediately before performing any operations such as DB calls. Even if it's GET data, not just POST data.
public function actionView($id)
{
/* #var $model yii\base\DynamicModel */
$model = DynamicModel::validateData(['id' => $id], [
'idValidation' => ['id', integer]
]);
if ($model->hasErrors()) {
throw new \yii\web\BadRequestHttpException();
}
/* #var $model yii\db\ActiveRecord */
$model = Model::findOne($id);
if ($model) {
return $this->render('view', ['model' => $model]);
} else {
throw new \yii\web\NotFoundHttpException();
}
}
What do you think? Is my approach reasonable or overkill and unnecessary?

Answer 1

If you're using action parameters, you don't need to validate this parameters again (unless you have specific reason for it, like closed dictionary of allowed values, but I guess this is not the case). If your action uses signature like actionView($id) Yii will ensure few things before further processing of action:
$_GET['id'] exist, so $id will never be null. If someone will try to call this action without id value in GET, he will get BadRequestHttpException exception without calling action.
$_GET['id'] is a scalar. It means that if someone will try to pass array as id, he will get BadRequestHttpException exception without calling action.
So at this point in action you may be sure that $id is string. This is enough for findOne() safety. Even if you expect integer and someone pass blablabla as $id, it does not matter - he will get NotFoundHttpException anyway since there is no record with blablabla as id (this is impossible - blablabla in not a valid integer) - there is no need for extra check here. So default examples generated by Gii or from Yii documentation are safe. So your approach is a overkill and it is completely unnecessary.
Situation may change when $id can be array, since array allows much more powerful syntax. You need to take extra attention when:
You're explicitly allowing array as action param: actionView(array $id).
You're not using action params and using $_GET params directly: $id = $_GET['id'] or $id = Yii::$app->request->get('id') - in these cases $id can be array even if you're expecting scalar.
In this case $id value may be quite surprising. For example attacker may pass multiple IDs even if you're expecting single ID. Or filter by specified field instead of primary key, by passing ['email' => 'user#example.com'] as a $id - users will be searched by email field (or any other) even if intention is to filter only by ID. In such cases you should validate this array to make sure that it contains only expected values.
In older version this also allows for SQL Injection, since columns names (keys in array) were not escaped (this is still valid for where()). See 2.0.15 release announcement with some explanation.